11 files changed, 269 insertions, 76 deletions

diff --git a/deploy/flake.lock b/deploy/flake.lock
index bd2ffb4..0424355 100644
--- a/deploy/flake.lock
+++ b/deploy/flake.lock
@@ -119,7 +119,7 @@
       },
       "locked": {
         "lastModified": 1,
-        "narHash": "sha256-8fef5NmMlX9+iOpw1/qXEtJ6cAWFvV/SO6YJs1e3D4U=",
+        "narHash": "sha256-Kt/2cr2zTi341YxLHDQAc5aYfEyuoVLpZQ9pJFDjwrc=",
         "path": "../../flakes/private/borg_backup",
         "type": "path"
       },
@@ -926,6 +926,18 @@
         "type": "path"
       }
     },
+    "environment_36": {
+      "locked": {
+        "lastModified": 1,
+        "narHash": "sha256-PQ5694ARRlpj00lk/C/T0UPGhPO+n0TEcLR1mde0s8M=",
+        "path": "../environment",
+        "type": "path"
+      },
+      "original": {
+        "path": "../environment",
+        "type": "path"
+      }
+    },
     "environment_4": {
       "locked": {
         "lastModified": 1,
@@ -2836,7 +2848,7 @@
       },
       "locked": {
         "lastModified": 1,
-        "narHash": "sha256-UeVBaRHhhvyP3ueiuo2+Xo8DusK9WuyHwuOllENlmvc=",
+        "narHash": "sha256-2fqc9ZDvQpvgXGdT65wit8tr7Q9QeQQ5qSh2qM24mkw=",
         "path": "../flakes",
         "type": "path"
       },
@@ -3886,7 +3898,7 @@
       },
       "locked": {
         "lastModified": 1,
-        "narHash": "sha256-eWqhsiYAFY0WoF24muaGHQ86FXgBsiuQ30VY7eOQ5IA=",
+        "narHash": "sha256-0vnHkdR8S1iOAjNl4pQx/Tehv43IfkTw30momDbDWyE=",
         "path": "../systems/backup-2",
         "type": "path"
       },
@@ -3958,7 +3970,7 @@
       },
       "locked": {
         "lastModified": 1,
-        "narHash": "sha256-74KlRId81x4Vj7fOQBteygUqYLvmKrDvGbQyzl0Zysc=",
+        "narHash": "sha256-DYnB2oXltA+Xqoeaz64z0e1tO5tmaqyV7jq28MK9wiM=",
         "path": "../systems/eldiron",
         "type": "path"
       },
@@ -4023,13 +4035,14 @@
         "impermanence": "impermanence",
         "my-lib": "my-lib_6",
         "nixpkgs": "nixpkgs_71",
+        "private-borg-backup": "private-borg-backup_2",
         "private-environment": "private-environment_2",
         "private-system": "private-system_2",
         "public-secrets": "public-secrets_2"
       },
       "locked": {
         "lastModified": 1,
-        "narHash": "sha256-XQ6MS/zL/AVQd71NG8h2mbbxjuRU3dKLi1s2qTY3Z/0=",
+        "narHash": "sha256-xzA9F1DcwBysoy8gVss57IQ2ivWsMCi5PJxLHJDqEUM=",
         "path": "../systems/zoldene",
         "type": "path"
       },
@@ -7519,7 +7532,23 @@
       },
       "locked": {
         "lastModified": 1,
-        "narHash": "sha256-8fef5NmMlX9+iOpw1/qXEtJ6cAWFvV/SO6YJs1e3D4U=",
+        "narHash": "sha256-Kt/2cr2zTi341YxLHDQAc5aYfEyuoVLpZQ9pJFDjwrc=",
+        "path": "../../flakes/private/borg_backup",
+        "type": "path"
+      },
+      "original": {
+        "path": "../../flakes/private/borg_backup",
+        "type": "path"
+      }
+    },
+    "private-borg-backup_2": {
+      "inputs": {
+        "environment": "environment_27",
+        "secrets": "secrets_21"
+      },
+      "locked": {
+        "lastModified": 1,
+        "narHash": "sha256-Kt/2cr2zTi341YxLHDQAc5aYfEyuoVLpZQ9pJFDjwrc=",
         "path": "../../flakes/private/borg_backup",
         "type": "path"
       },
@@ -7739,7 +7768,7 @@
     "private-system_2": {
       "inputs": {
         "backports": "backports_6",
-        "environment": "environment_27",
+        "environment": "environment_28",
         "mypackages": "mypackages_9",
         "myuids": "myuids_28",
         "secrets-public": "secrets-public_6"
@@ -8076,7 +8105,7 @@
         "devshell": "devshell",
         "main-flake": "main-flake",
         "nixpkgs": "nixpkgs_105",
-        "secrets": "secrets_28"
+        "secrets": "secrets_29"
       }
     },
     "rsync_backup": {
@@ -8397,12 +8426,12 @@
     },
     "s-private-borg-backup": {
       "inputs": {
-        "environment": "environment_28",
-        "secrets": "secrets_21"
+        "environment": "environment_29",
+        "secrets": "secrets_22"
       },
       "locked": {
         "lastModified": 1,
-        "narHash": "sha256-8fef5NmMlX9+iOpw1/qXEtJ6cAWFvV/SO6YJs1e3D4U=",
+        "narHash": "sha256-Kt/2cr2zTi341YxLHDQAc5aYfEyuoVLpZQ9pJFDjwrc=",
         "path": "./private/borg_backup",
         "type": "path"
       },
@@ -8430,7 +8459,7 @@
     },
     "s-private-chatons": {
       "inputs": {
-        "environment": "environment_29"
+        "environment": "environment_30"
       },
       "locked": {
         "lastModified": 1,
@@ -8457,8 +8486,8 @@
     },
     "s-private-mail-relay": {
       "inputs": {
-        "environment": "environment_30",
-        "secrets": "secrets_22"
+        "environment": "environment_31",
+        "secrets": "secrets_23"
       },
       "locked": {
         "lastModified": 1,
@@ -8473,11 +8502,11 @@
     },
     "s-private-milters": {
       "inputs": {
-        "environment": "environment_31",
+        "environment": "environment_32",
         "files-watcher": "files-watcher_13",
         "openarc": "openarc_12",
         "opendmarc": "opendmarc_6",
-        "secrets": "secrets_23"
+        "secrets": "secrets_24"
       },
       "locked": {
         "lastModified": 1,
@@ -8492,10 +8521,10 @@
     },
     "s-private-monitoring": {
       "inputs": {
-        "environment": "environment_32",
+        "environment": "environment_33",
         "naemon": "naemon_6",
         "nixpkgs-lib": "nixpkgs-lib_26",
-        "secrets": "secrets_24"
+        "secrets": "secrets_25"
       },
       "locked": {
         "lastModified": 1,
@@ -8512,7 +8541,7 @@
       "inputs": {
         "files-watcher": "files-watcher_14",
         "openarc": "openarc_14",
-        "secrets": "secrets_25"
+        "secrets": "secrets_26"
       },
       "locked": {
         "lastModified": 1,
@@ -8527,10 +8556,10 @@
     },
     "s-private-opendmarc": {
       "inputs": {
-        "environment": "environment_33",
+        "environment": "environment_34",
         "files-watcher": "files-watcher_15",
         "opendmarc": "opendmarc_7",
-        "secrets": "secrets_26"
+        "secrets": "secrets_27"
       },
       "locked": {
         "lastModified": 1,
@@ -8590,8 +8619,8 @@
     },
     "s-private-ssh": {
       "inputs": {
-        "environment": "environment_34",
-        "secrets": "secrets_27"
+        "environment": "environment_35",
+        "secrets": "secrets_28"
       },
       "locked": {
         "lastModified": 1,
@@ -8607,7 +8636,7 @@
     "s-private-system": {
       "inputs": {
         "backports": "backports_7",
-        "environment": "environment_35",
+        "environment": "environment_36",
         "mypackages": "mypackages_12",
         "myuids": "myuids_42",
         "secrets-public": "secrets-public_7"
@@ -9007,6 +9036,18 @@
       }
     },
     "secrets_28": {
+      "locked": {
+        "lastModified": 1,
+        "narHash": "sha256-5AakznhrJFmwCD7lr4JEh55MtdAJL6WA/YuBks6ISSE=",
+        "path": "../../secrets",
+        "type": "path"
+      },
+      "original": {
+        "path": "../../secrets",
+        "type": "path"
+      }
+    },
+    "secrets_29": {
       "inputs": {
         "nixpkgs": "nixpkgs_106"
       },
diff --git a/flake.lock b/flake.lock
index 249b42c..0ef8c4c 100644
--- a/flake.lock
+++ b/flake.lock
@@ -119,7 +119,7 @@
       },
       "locked": {
         "lastModified": 1,
-        "narHash": "sha256-8fef5NmMlX9+iOpw1/qXEtJ6cAWFvV/SO6YJs1e3D4U=",
+        "narHash": "sha256-Kt/2cr2zTi341YxLHDQAc5aYfEyuoVLpZQ9pJFDjwrc=",
         "path": "../../flakes/private/borg_backup",
         "type": "path"
       },
@@ -926,6 +926,18 @@
         "type": "path"
       }
     },
+    "environment_36": {
+      "locked": {
+        "lastModified": 1,
+        "narHash": "sha256-PQ5694ARRlpj00lk/C/T0UPGhPO+n0TEcLR1mde0s8M=",
+        "path": "../environment",
+        "type": "path"
+      },
+      "original": {
+        "path": "../environment",
+        "type": "path"
+      }
+    },
     "environment_4": {
       "locked": {
         "lastModified": 1,
@@ -2713,11 +2725,11 @@
         "s-secrets": "s-secrets",
         "s-surfer": "s-surfer",
         "s-taskwarrior-web": "s-taskwarrior-web",
-        "secrets": "secrets_28"
+        "secrets": "secrets_29"
       },
       "locked": {
         "lastModified": 1,
-        "narHash": "sha256-UeVBaRHhhvyP3ueiuo2+Xo8DusK9WuyHwuOllENlmvc=",
+        "narHash": "sha256-2fqc9ZDvQpvgXGdT65wit8tr7Q9QeQQ5qSh2qM24mkw=",
         "path": "./flakes",
         "type": "path"
       },
@@ -3902,7 +3914,7 @@
       },
       "locked": {
         "lastModified": 1,
-        "narHash": "sha256-eWqhsiYAFY0WoF24muaGHQ86FXgBsiuQ30VY7eOQ5IA=",
+        "narHash": "sha256-0vnHkdR8S1iOAjNl4pQx/Tehv43IfkTw30momDbDWyE=",
         "path": "../systems/backup-2",
         "type": "path"
       },
@@ -3974,7 +3986,7 @@
       },
       "locked": {
         "lastModified": 1,
-        "narHash": "sha256-74KlRId81x4Vj7fOQBteygUqYLvmKrDvGbQyzl0Zysc=",
+        "narHash": "sha256-DYnB2oXltA+Xqoeaz64z0e1tO5tmaqyV7jq28MK9wiM=",
         "path": "../systems/eldiron",
         "type": "path"
       },
@@ -4039,13 +4051,14 @@
         "impermanence": "impermanence",
         "my-lib": "my-lib_6",
         "nixpkgs": "nixpkgs_71",
+        "private-borg-backup": "private-borg-backup_2",
         "private-environment": "private-environment_2",
         "private-system": "private-system_2",
         "public-secrets": "public-secrets_2"
       },
       "locked": {
         "lastModified": 1,
-        "narHash": "sha256-XQ6MS/zL/AVQd71NG8h2mbbxjuRU3dKLi1s2qTY3Z/0=",
+        "narHash": "sha256-xzA9F1DcwBysoy8gVss57IQ2ivWsMCi5PJxLHJDqEUM=",
         "path": "../systems/zoldene",
         "type": "path"
       },
@@ -7535,7 +7548,23 @@
       },
       "locked": {
         "lastModified": 1,
-        "narHash": "sha256-8fef5NmMlX9+iOpw1/qXEtJ6cAWFvV/SO6YJs1e3D4U=",
+        "narHash": "sha256-Kt/2cr2zTi341YxLHDQAc5aYfEyuoVLpZQ9pJFDjwrc=",
+        "path": "../../flakes/private/borg_backup",
+        "type": "path"
+      },
+      "original": {
+        "path": "../../flakes/private/borg_backup",
+        "type": "path"
+      }
+    },
+    "private-borg-backup_2": {
+      "inputs": {
+        "environment": "environment_27",
+        "secrets": "secrets_21"
+      },
+      "locked": {
+        "lastModified": 1,
+        "narHash": "sha256-Kt/2cr2zTi341YxLHDQAc5aYfEyuoVLpZQ9pJFDjwrc=",
         "path": "../../flakes/private/borg_backup",
         "type": "path"
       },
@@ -7755,7 +7784,7 @@
     "private-system_2": {
       "inputs": {
         "backports": "backports_6",
-        "environment": "environment_27",
+        "environment": "environment_28",
         "mypackages": "mypackages_9",
         "myuids": "myuids_28",
         "secrets-public": "secrets-public_6"
@@ -8413,12 +8442,12 @@
     },
     "s-private-borg-backup": {
       "inputs": {
-        "environment": "environment_28",
-        "secrets": "secrets_21"
+        "environment": "environment_29",
+        "secrets": "secrets_22"
       },
       "locked": {
         "lastModified": 1,
-        "narHash": "sha256-8fef5NmMlX9+iOpw1/qXEtJ6cAWFvV/SO6YJs1e3D4U=",
+        "narHash": "sha256-Kt/2cr2zTi341YxLHDQAc5aYfEyuoVLpZQ9pJFDjwrc=",
         "path": "./private/borg_backup",
         "type": "path"
       },
@@ -8446,7 +8475,7 @@
     },
     "s-private-chatons": {
       "inputs": {
-        "environment": "environment_29"
+        "environment": "environment_30"
       },
       "locked": {
         "lastModified": 1,
@@ -8473,8 +8502,8 @@
     },
     "s-private-mail-relay": {
       "inputs": {
-        "environment": "environment_30",
-        "secrets": "secrets_22"
+        "environment": "environment_31",
+        "secrets": "secrets_23"
       },
       "locked": {
         "lastModified": 1,
@@ -8489,11 +8518,11 @@
     },
     "s-private-milters": {
       "inputs": {
-        "environment": "environment_31",
+        "environment": "environment_32",
         "files-watcher": "files-watcher_13",
         "openarc": "openarc_12",
         "opendmarc": "opendmarc_6",
-        "secrets": "secrets_23"
+        "secrets": "secrets_24"
       },
       "locked": {
         "lastModified": 1,
@@ -8508,10 +8537,10 @@
     },
     "s-private-monitoring": {
       "inputs": {
-        "environment": "environment_32",
+        "environment": "environment_33",
         "naemon": "naemon_6",
         "nixpkgs-lib": "nixpkgs-lib_27",
-        "secrets": "secrets_24"
+        "secrets": "secrets_25"
       },
       "locked": {
         "lastModified": 1,
@@ -8528,7 +8557,7 @@
       "inputs": {
         "files-watcher": "files-watcher_14",
         "openarc": "openarc_14",
-        "secrets": "secrets_25"
+        "secrets": "secrets_26"
       },
       "locked": {
         "lastModified": 1,
@@ -8543,10 +8572,10 @@
     },
     "s-private-opendmarc": {
       "inputs": {
-        "environment": "environment_33",
+        "environment": "environment_34",
         "files-watcher": "files-watcher_15",
         "opendmarc": "opendmarc_7",
-        "secrets": "secrets_26"
+        "secrets": "secrets_27"
       },
       "locked": {
         "lastModified": 1,
@@ -8606,8 +8635,8 @@
     },
     "s-private-ssh": {
       "inputs": {
-        "environment": "environment_34",
-        "secrets": "secrets_27"
+        "environment": "environment_35",
+        "secrets": "secrets_28"
       },
       "locked": {
         "lastModified": 1,
@@ -8623,7 +8652,7 @@
     "s-private-system": {
       "inputs": {
         "backports": "backports_7",
-        "environment": "environment_35",
+        "environment": "environment_36",
         "mypackages": "mypackages_12",
         "myuids": "myuids_42",
         "secrets-public": "secrets-public_7"
@@ -9025,6 +9054,18 @@
     "secrets_28": {
       "locked": {
         "lastModified": 1,
+        "narHash": "sha256-5AakznhrJFmwCD7lr4JEh55MtdAJL6WA/YuBks6ISSE=",
+        "path": "../../secrets",
+        "type": "path"
+      },
+      "original": {
+        "path": "../../secrets",
+        "type": "path"
+      }
+    },
+    "secrets_29": {
+      "locked": {
+        "lastModified": 1,
         "narHash": "sha256-yvhc2jxW1AQVmtrKPoYPr5DgpXKt/ua+ATuxvE3iY6c=",
         "path": "./private/environment-dummy",
         "type": "path"
diff --git a/flakes/flake.lock b/flakes/flake.lock
index 4d254d8..b8f281f 100644
--- a/flakes/flake.lock
+++ b/flakes/flake.lock
@@ -119,7 +119,7 @@
       },
       "locked": {
         "lastModified": 1,
-        "narHash": "sha256-8fef5NmMlX9+iOpw1/qXEtJ6cAWFvV/SO6YJs1e3D4U=",
+        "narHash": "sha256-Kt/2cr2zTi341YxLHDQAc5aYfEyuoVLpZQ9pJFDjwrc=",
         "path": "../../flakes/private/borg_backup",
         "type": "path"
       },
@@ -906,6 +906,18 @@
         "type": "path"
       }
     },
+    "environment_36": {
+      "locked": {
+        "lastModified": 1,
+        "narHash": "sha256-PQ5694ARRlpj00lk/C/T0UPGhPO+n0TEcLR1mde0s8M=",
+        "path": "../environment",
+        "type": "path"
+      },
+      "original": {
+        "path": "../environment",
+        "type": "path"
+      }
+    },
     "environment_4": {
       "locked": {
         "lastModified": 1,
@@ -3806,7 +3818,7 @@
       },
       "locked": {
         "lastModified": 1,
-        "narHash": "sha256-eWqhsiYAFY0WoF24muaGHQ86FXgBsiuQ30VY7eOQ5IA=",
+        "narHash": "sha256-0vnHkdR8S1iOAjNl4pQx/Tehv43IfkTw30momDbDWyE=",
         "path": "../systems/backup-2",
         "type": "path"
       },
@@ -3878,7 +3890,7 @@
       },
       "locked": {
         "lastModified": 1,
-        "narHash": "sha256-74KlRId81x4Vj7fOQBteygUqYLvmKrDvGbQyzl0Zysc=",
+        "narHash": "sha256-DYnB2oXltA+Xqoeaz64z0e1tO5tmaqyV7jq28MK9wiM=",
         "path": "../systems/eldiron",
         "type": "path"
       },
@@ -3943,13 +3955,14 @@
         "impermanence": "impermanence",
         "my-lib": "my-lib_6",
         "nixpkgs": "nixpkgs_70",
+        "private-borg-backup": "private-borg-backup_2",
         "private-environment": "private-environment_2",
         "private-system": "private-system_2",
         "public-secrets": "public-secrets_2"
       },
       "locked": {
         "lastModified": 1,
-        "narHash": "sha256-XQ6MS/zL/AVQd71NG8h2mbbxjuRU3dKLi1s2qTY3Z/0=",
+        "narHash": "sha256-xzA9F1DcwBysoy8gVss57IQ2ivWsMCi5PJxLHJDqEUM=",
         "path": "../systems/zoldene",
         "type": "path"
       },
@@ -7361,7 +7374,23 @@
       },
       "locked": {
         "lastModified": 1,
-        "narHash": "sha256-8fef5NmMlX9+iOpw1/qXEtJ6cAWFvV/SO6YJs1e3D4U=",
+        "narHash": "sha256-Kt/2cr2zTi341YxLHDQAc5aYfEyuoVLpZQ9pJFDjwrc=",
+        "path": "../../flakes/private/borg_backup",
+        "type": "path"
+      },
+      "original": {
+        "path": "../../flakes/private/borg_backup",
+        "type": "path"
+      }
+    },
+    "private-borg-backup_2": {
+      "inputs": {
+        "environment": "environment_27",
+        "secrets": "secrets_21"
+      },
+      "locked": {
+        "lastModified": 1,
+        "narHash": "sha256-Kt/2cr2zTi341YxLHDQAc5aYfEyuoVLpZQ9pJFDjwrc=",
         "path": "../../flakes/private/borg_backup",
         "type": "path"
       },
@@ -7581,7 +7610,7 @@
     "private-system_2": {
       "inputs": {
         "backports": "backports_6",
-        "environment": "environment_27",
+        "environment": "environment_28",
         "mypackages": "mypackages_9",
         "myuids": "myuids_28",
         "secrets-public": "secrets-public_6"
@@ -7958,7 +7987,7 @@
         "s-secrets": "s-secrets",
         "s-surfer": "s-surfer",
         "s-taskwarrior-web": "s-taskwarrior-web",
-        "secrets": "secrets_28"
+        "secrets": "secrets_29"
       }
     },
     "rsync_backup": {
@@ -8279,12 +8308,12 @@
     },
     "s-private-borg-backup": {
       "inputs": {
-        "environment": "environment_28",
-        "secrets": "secrets_21"
+        "environment": "environment_29",
+        "secrets": "secrets_22"
       },
       "locked": {
         "lastModified": 1,
-        "narHash": "sha256-8fef5NmMlX9+iOpw1/qXEtJ6cAWFvV/SO6YJs1e3D4U=",
+        "narHash": "sha256-Kt/2cr2zTi341YxLHDQAc5aYfEyuoVLpZQ9pJFDjwrc=",
         "path": "./private/borg_backup",
         "type": "path"
       },
@@ -8312,7 +8341,7 @@
     },
     "s-private-chatons": {
       "inputs": {
-        "environment": "environment_29"
+        "environment": "environment_30"
       },
       "locked": {
         "lastModified": 1,
@@ -8339,8 +8368,8 @@
     },
     "s-private-mail-relay": {
       "inputs": {
-        "environment": "environment_30",
-        "secrets": "secrets_22"
+        "environment": "environment_31",
+        "secrets": "secrets_23"
       },
       "locked": {
         "lastModified": 1,
@@ -8355,11 +8384,11 @@
     },
     "s-private-milters": {
       "inputs": {
-        "environment": "environment_31",
+        "environment": "environment_32",
         "files-watcher": "files-watcher_13",
         "openarc": "openarc_12",
         "opendmarc": "opendmarc_6",
-        "secrets": "secrets_23"
+        "secrets": "secrets_24"
       },
       "locked": {
         "lastModified": 1,
@@ -8374,10 +8403,10 @@
     },
     "s-private-monitoring": {
       "inputs": {
-        "environment": "environment_32",
+        "environment": "environment_33",
         "naemon": "naemon_6",
         "nixpkgs-lib": "nixpkgs-lib_26",
-        "secrets": "secrets_24"
+        "secrets": "secrets_25"
       },
       "locked": {
         "lastModified": 1,
@@ -8394,7 +8423,7 @@
       "inputs": {
         "files-watcher": "files-watcher_14",
         "openarc": "openarc_14",
-        "secrets": "secrets_25"
+        "secrets": "secrets_26"
       },
       "locked": {
         "lastModified": 1,
@@ -8409,10 +8438,10 @@
     },
     "s-private-opendmarc": {
       "inputs": {
-        "environment": "environment_33",
+        "environment": "environment_34",
         "files-watcher": "files-watcher_15",
         "opendmarc": "opendmarc_7",
-        "secrets": "secrets_26"
+        "secrets": "secrets_27"
       },
       "locked": {
         "lastModified": 1,
@@ -8472,8 +8501,8 @@
     },
     "s-private-ssh": {
       "inputs": {
-        "environment": "environment_34",
-        "secrets": "secrets_27"
+        "environment": "environment_35",
+        "secrets": "secrets_28"
       },
       "locked": {
         "lastModified": 1,
@@ -8489,7 +8518,7 @@
     "s-private-system": {
       "inputs": {
         "backports": "backports_7",
-        "environment": "environment_35",
+        "environment": "environment_36",
         "mypackages": "mypackages_12",
         "myuids": "myuids_42",
         "secrets-public": "secrets-public_7"
@@ -8891,6 +8920,18 @@
     "secrets_28": {
       "locked": {
         "lastModified": 1,
+        "narHash": "sha256-5AakznhrJFmwCD7lr4JEh55MtdAJL6WA/YuBks6ISSE=",
+        "path": "../../secrets",
+        "type": "path"
+      },
+      "original": {
+        "path": "../../secrets",
+        "type": "path"
+      }
+    },
+    "secrets_29": {
+      "locked": {
+        "lastModified": 1,
         "narHash": "sha256-yvhc2jxW1AQVmtrKPoYPr5DgpXKt/ua+ATuxvE3iY6c=",
         "path": "./private/environment-dummy",
         "type": "path"
diff --git a/flakes/private/borg_backup/flake.nix b/flakes/private/borg_backup/flake.nix
index ad7d6eb..ab288f6 100644
--- a/flakes/private/borg_backup/flake.nix
+++ b/flakes/private/borg_backup/flake.nix
@@ -130,6 +130,13 @@
               Whether to enable remote backups.
             '';
           };
+          services.borgBackup.cronSpec = lib.mkOption {
+            type = lib.types.str;
+            default = "0 0 * * *";
+            description = ''
+              Cron spec for running borgbackup
+            '';
+          };
           services.borgBackup.helpers = lib.mkOption {
             readOnly = true;
             description = ''
@@ -310,7 +317,7 @@
           services.cron = {
             enable = true;
             systemCronJobs = [
-              "0 0 * * * root ${borg_backup}/bin/borg_backup 300"
+              "${config.services.borgBackup.cronSpec} root ${borg_backup}/bin/borg_backup 300"
             ];
 
           };
diff --git a/systems/backup-2/base.nix b/systems/backup-2/base.nix
index 61eecc9..cdaebd3 100644
--- a/systems/backup-2/base.nix
+++ b/systems/backup-2/base.nix
@@ -93,6 +93,7 @@
   };
 
   services.borgBackup.enable = true;
+  services.borgBackup.cronSpec = "30 3 * * *";
 
   services.rsyncBackup = {
     mountpoint = "/backup2";
diff --git a/systems/backup-2/flake.lock b/systems/backup-2/flake.lock
index 83e1cad..c2a087b 100644
--- a/systems/backup-2/flake.lock
+++ b/systems/backup-2/flake.lock
@@ -23,7 +23,7 @@
       },
       "locked": {
         "lastModified": 1,
-        "narHash": "sha256-8fef5NmMlX9+iOpw1/qXEtJ6cAWFvV/SO6YJs1e3D4U=",
+        "narHash": "sha256-Kt/2cr2zTi341YxLHDQAc5aYfEyuoVLpZQ9pJFDjwrc=",
         "path": "../../flakes/private/borg_backup",
         "type": "path"
       },
diff --git a/systems/eldiron/flake.lock b/systems/eldiron/flake.lock
index bb961b0..8392aa7 100644
--- a/systems/eldiron/flake.lock
+++ b/systems/eldiron/flake.lock
@@ -1985,7 +1985,7 @@
       },
       "locked": {
         "lastModified": 1,
-        "narHash": "sha256-8fef5NmMlX9+iOpw1/qXEtJ6cAWFvV/SO6YJs1e3D4U=",
+        "narHash": "sha256-Kt/2cr2zTi341YxLHDQAc5aYfEyuoVLpZQ9pJFDjwrc=",
         "path": "../../flakes/private/borg_backup",
         "type": "path"
       },
diff --git a/systems/zoldene/base.nix b/systems/zoldene/base.nix
index 947859a..187eb11 100644
--- a/systems/zoldene/base.nix
+++ b/systems/zoldene/base.nix
@@ -16,6 +16,9 @@ in
     ./synapse.nix
   ];
 
+  services.borgBackup.enable = true;
+  services.borgBackup.cronSpec = "0 20 * * *";
+
   programs.ssh.package = pkgs.openssh;
   services.openssh = {
     settings.KbdInteractiveAuthentication = false;
diff --git a/systems/zoldene/flake.lock b/systems/zoldene/flake.lock
index e8389c6..bd8fc48 100644
--- a/systems/zoldene/flake.lock
+++ b/systems/zoldene/flake.lock
@@ -68,6 +68,18 @@
         "type": "path"
       }
     },
+    "environment_2": {
+      "locked": {
+        "lastModified": 1,
+        "narHash": "sha256-PQ5694ARRlpj00lk/C/T0UPGhPO+n0TEcLR1mde0s8M=",
+        "path": "../environment",
+        "type": "path"
+      },
+      "original": {
+        "path": "../environment",
+        "type": "path"
+      }
+    },
     "flake-compat": {
       "flake": false,
       "locked": {
@@ -433,6 +445,22 @@
         "type": "github"
       }
     },
+    "private-borg-backup": {
+      "inputs": {
+        "environment": "environment",
+        "secrets": "secrets"
+      },
+      "locked": {
+        "lastModified": 1,
+        "narHash": "sha256-Kt/2cr2zTi341YxLHDQAc5aYfEyuoVLpZQ9pJFDjwrc=",
+        "path": "../../flakes/private/borg_backup",
+        "type": "path"
+      },
+      "original": {
+        "path": "../../flakes/private/borg_backup",
+        "type": "path"
+      }
+    },
     "private-environment": {
       "locked": {
         "lastModified": 1,
@@ -448,7 +476,7 @@
     "private-system": {
       "inputs": {
         "backports": "backports",
-        "environment": "environment",
+        "environment": "environment_2",
         "mypackages": "mypackages",
         "myuids": "myuids",
         "secrets-public": "secrets-public"
@@ -481,11 +509,24 @@
         "impermanence": "impermanence",
         "my-lib": "my-lib",
         "nixpkgs": "nixpkgs_5",
+        "private-borg-backup": "private-borg-backup",
         "private-environment": "private-environment",
         "private-system": "private-system",
         "public-secrets": "public-secrets"
       }
     },
+    "secrets": {
+      "locked": {
+        "lastModified": 1,
+        "narHash": "sha256-5AakznhrJFmwCD7lr4JEh55MtdAJL6WA/YuBks6ISSE=",
+        "path": "../../secrets",
+        "type": "path"
+      },
+      "original": {
+        "path": "../../secrets",
+        "type": "path"
+      }
+    },
     "secrets-public": {
       "locked": {
         "lastModified": 1,
diff --git a/systems/zoldene/flake.nix b/systems/zoldene/flake.nix
index 7b7b4b7..52db1c4 100644
--- a/systems/zoldene/flake.nix
+++ b/systems/zoldene/flake.nix
@@ -6,6 +6,7 @@
     public-secrets.url = "path:../../flakes/secrets";
     private-environment.url = "path:../../flakes/private/environment";
     private-system.url = "path:../../flakes/private/system";
+    private-borg-backup.url = "path:../../flakes/private/borg_backup";
   };
   outputs = inputs@{ self, nixpkgs, my-lib, ... }:
     my-lib.lib.mkColmenaFlake {
@@ -25,6 +26,7 @@
 
         secrets = public-secrets.nixosModule;
 
+        borg-backup = private-borg-backup.nixosModule;
         environment = private-environment.nixosModule;
         system = private-system.nixosModule;
       };
diff --git a/systems/zoldene/virtualisation.nix b/systems/zoldene/virtualisation.nix
index d2212fe..424f43f 100644
--- a/systems/zoldene/virtualisation.nix
+++ b/systems/zoldene/virtualisation.nix
@@ -6,6 +6,14 @@
   virtualisation.docker.enable = true;
   disko.devices.zpool.zfast.datasets."root/persist/var/lib/docker" =
     { type = "zfs_fs"; mountpoint = "/persist/zfast/var/lib/docker"; options.mountpoint = "legacy"; };
+  systemd.services.docker.after = [
+    "var-lib-docker.mount"
+    "persist-zfast-var-lib-docker.mount"
+  ];
+  systemd.services.docker.unitConfig.BindsTo = [
+    "var-lib-docker.mount"
+    "persist-zfast-var-lib-docker.mount"
+  ];
 
   ### Enable LXC
   disko.devices.zpool.zfast.datasets."root/persist/var/lib/lxc" =
@@ -14,12 +22,21 @@
     enable = true;
     lxcfs.enable = true;
   };
+  systemd.services.lxc.after = [
+    "var-lib-lxc.mount"
+    "persist-zfast-var-lib-lxc.mount"
+  ];
+  systemd.services.lxc.unitConfig.BindsTo = [
+    "var-lib-lxc.mount"
+    "persist-zfast-var-lib-lxc.mount"
+  ];
 
   ### Enable libvirtd
   virtualisation.libvirtd = {
     enable = true;
     qemu.package = pkgs-no-overlay.qemu;
   };
+  # No persistence for libvirtd: config is supposed to be persisted via config
 
   ### Persistence for LXC / Docker
   environment.persistence."/persist/zfast".directories = [
@@ -43,4 +60,3 @@
     "net.ipv4.conf.default.forwarding" = true;
   };
 }
-